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The Health Insurance Portability and Accountability Act 
(HIPAA) of 1996: Overview and Guidance on 
Frequently Asked Questions 

Summary 

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 (P.L. 
104-191), provided for changes in the health insurance market. It guaranteed the 
availability and renewability of health insurance coverage for certain employees and 
individuals, and limited the use of preexisting condition restrictions. The Act created 
federal standards for insurers, health maintenance organizations (HMOs), and 
employer-provided health plans, including those that self-insure. It permitted, 
however, substantial state flexibility for compliance with the requirements on 
insurers. 

HIPAA also included tax provisions relating to health insurance. It permitted 
a limited number of small businesses and self-employed individuals to contribute to 
tax-advantaged medical savings accounts (MSAs) established in conjunction with 
high-deductible health insurance plans. It increased the deduction for health 
insurance that self-employed taxpayers may claim. In addition, it allowed long-term 
care expenses to be treated like deductible medical expenses and clarified the tax 
treatment of long-term care insurance. 

Finally, the Act included administrative simplification and privacy provisions 
instructing the Secretary of HHS to issue standards addressing the electronic 
transmission of health information and the privacy of personally identifiable medical 
information. 

Since the passage of HIPAA, there have been subsequent amendments. In 1996, 
new provisions required group health plans and insurers to cover minimum hospital 
stays for maternity care and for a limited period, to provide parity in certain mental 
health benefits. Parity was later extended for one year. In 1998, a provision was 
passed requiring health plans that cover mastectomy to also offer reconstructive 
breast surgery. Amendments have also increased the tax deduction for premiums 
paid by self-employed taxpayers. 

The Act, as amended, continues to generate numerous questions. What kinds 
of policies does it cover? Does it help people who are currently uninsured? Does it 
help people with preexisting medical conditions? How does it affect health insurance 
premiums? How do its requirements interact with the Consolidated Omnibus Budget 
Reconciliation Act (COBRA) continuation coverage? Answers to those questions, 
as well as other commonly asked questions, are provided, as well as descriptions of 
each of the major sections of HIPAA. 

Some of the answers provided may not be definitive. This is because, in some 
cases, final regulations have not yet been promulgated. Other regulations, such as 
those defining the administrative simplification provisions, remain under 
development. In addition, the answers to many questions about the requirements on 
the individual health insurance market depend upon particular state responses to the 
Act. For some provisions, states were allowed the choice of implementing the 
HIPAA requirements (“the federal fallback”) or establishing acceptable alternative 
mechanisms. 
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The Health Insurance Portability and 
Accountability Act (HIPAA) of 1996: 
Overview and Guidance on 
Frequently Asked Questions 

The Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191, 
HIPAA) provided for changes in the health insurance market and imposed certain 
federal requirements on health insurance plans offered by public and private 
employers. It guaranteed the availability and renewability of health insurance 
coverage for certain employees and individuals, and limited the use of preexisting 
condition restrictions. The Act established federal standards for insurers, health 
maintenance organizations (HMOs), and employer plans, including those who self- 
insure. However, it allowed states and sometimes insurers substantial state flexibility 
for compliance with the federal requirements. 

HIPAA also included tax provisions relating to health insurance. It permitted 
a limited number of small businesses and self-employed individuals to contribute to 
tax- advantaged medical savings accounts (MSAs) established in conjunction with 
high-deductible health insurance plans. It increased the deduction for health 
insurance that self-employed taxpayers may claim. In addition, it allowed long-term 
care expenses to be treated like deductible medical expenses and clarified the tax 
treatment of long-term care insurance. 

HIPAA amended the Employee Retirement Income Security Act (ERISA), the 
Public Health Service (PHS) Act, and the Internal Revenue Code (IRC). In general, 
requirements on employer plans are found in the ERISA and IRC amendments; 
requirements on health insurance issuers, such as insurance carriers and health 
maintenance organizations (HMOs) are found in the PHS Act and ERISA 
amendments. The increased deduction for the self-employed, tax-favored MSAs, and 
long-term care provisions are amendments to the IRC. 



Part I. The Act in General 

The basic intent of HIPAA’ s health insurance provisions is to lower the 
possibility that people and small employers will lose existing health plan coverage, 
and to make it easier for individuals to switch plans or to purchase coverage on their 
own if they lose employer-offered coverage. The health insurance reforms ensure 
that people who are moving from one job to another or from employment to 
unemployment are not denied health insurance because they have a preexisting 
medical condition (portability) and limit the waiting time before a plan covers any 
preexisting medical condition for participants and beneficiaries in group health plans. 
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The reforms were also intended to guarantee that individuals and employers who 
choose to purchase coverage are able to find a plan (guaranteed issue) and that 
individuals already covered, as well as employers that offer coverage to their 
employees, are able to renew their coverage (guaranteed renewal). Finally, the health 
insurance provisions prohibit discrimination on the basis of health status (non- 
discrimination) and require plans to offer special enrollment periods. 

Other HIPAA provisions seek to make health insurance more affordable. The 
Act raised the tax deduction for health insurance premiums paid by the self- 
employed. MS As coupled with qualified high deductible health insurance plans were 
made available on a trial basis to a limited number of individuals. New tax 
incentives were made available to encourage individuals and employers to purchase 
long-term care insurance. Finally, the Act included administrative simplification and 
privacy provisions instructing the Secretary of HHS to issue standards addressing the 
electronic transmission of health information and the privacy of personally 
identifiable medical information. 

Additional federal protections have been added since the passage of HIPAA. 
The protections required plans that cover newborn delivery to allow for a minimum 
two-day hospital stay under certain conditions, required plans that offer mental health 
services to offer them subject to similar limitations as other health benefits, and 
required plans that cover mastectomy to also cover reconstructive surgery. In 
addition, the deduction allowed for premium costs for the self-employed was 
changed. 

Does HIPAA help individuals who are uninsured? HIPAA’s insurance 
provisions were designed to help insured Americans who have a preexisting medical 
condition and have stayed in a job because they fear that they would lose coverage 
for such a condition if they change to a new employer or move to an individual 
policy. It also would help those who have been denied the option to purchase 
insurance as an individual or through their employer because of their health status. 
They do not address the larger problem of the uninsured, estimated to be 45 million 
people in 2003, although other HIPAA provisions, such as the tax deductibility of 
health insurance costs for the self-employed, may encourage some uninsured, self- 
employed individuals to purchase coverage for themselves. 

It is also the case that HIPAA largely addresses the availability of insurance and 
does not regulate the price of health insurance coverage. 1 Some evidence suggests 
that the cost of health insurance in the individual market for individuals taking 
advantage of HIPAA’s group-to-individual portability provisions is significantly 
higher than the cost for individuals who could otherwise obtain insurance. This may 
be discouraging many “HIPAA eligibles” from buying insurance. 2 Whether this 
experience continues over the long run remains to be seen. 



1 Insurance that is regulated by state law may be subject to state premium limits. There are 
no premium limits on self-insured employer plans. 

2 U.S. General Accounting Office, Health Insurance Standards: New Federal Law Creates 
Challenges for Consumers, Insurers, Regulators, GAO/HEHS-98-67 (February 1998). 
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Are employers required to offer health insurance as a benefit? No, 

the Act does not require employers to offer or pay for health insurance for their 
employees. Also, the Act does not require employers to offer or pay for family 
coverage (spouses and dependents). Finally, the Act does not require employers to 
cover part time, seasonal, or temporary employees. However, an employer who 
elects to sponsor a group health plan has to comply with certain requirements of the 
Act. These requirements: (a) restrict the use of preexisting condition limitation 
periods; (b) prohibit an employer plan from discriminating on the basis of health 
status in determining the eligibility of an employee to enroll in a group health plan 
(and the employee’ s spouse and dependents if the plan provides family coverage); (c) 
prohibit an employer plan from requiring an individual to pay premiums or 
contributions which are greater than those charged to a similarly situated individual 
on the basis of health status; and (d) mandate documentation of creditable coverage. 



Part II. Health Insurance Reforms 



Portability 

HIPAA’s “portability” protection means that once a person obtains creditable 
health plan coverage, he or she can use evidence of that coverage to reduce or 
eliminate any preexisting medical condition exclusion period that might otherwise 
be imposed when moving to another health plan. The protections apply when a 
person moves from one group health plan to another, from a group health plan to an 
individual policy, or from an individual policy to a group health plan. The concept 
of portability is really one of being able to maintain coverage and being given credit 
for having been insured when changing health plans. It does not mean that an 
individual can take a specific health insurance policy from one job to another. 

What is creditable coverage? The concept of creditable coverage is that 
individuals are given credit for previous insurance when applying for a new plan. 

Under the Act, creditable coverage is coverage under any of the following: (a) 
a group health plan; (b) health insurance coverage 3 , including individual health 
insurance coverage; (c) Medicare; (d) Medicaid; (e) military health care; 4 (f) a 
medical care program of the Indian Health Service or of a tribal organization; (g) a 
state health benefits risk pool; (h) the Federal Employee Health Benefits Program; 
(i) a public health plan (as defined in regulations); (j) a health benefit plan under 



3 Health insurance coverage is defined as benefits consisting of medical care (provided 
directly, through insurance or reimbursement, or otherwise and including items and services 
paid for as medical care) under any hospital or medical service policy or certificate, hospital 
or medical service plan contract or HMO contract offered by a health insurance issuer. 

4 “Military health care” is care described under 10 U.S.C. Part 55. 
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Section 5(e) of the Peace Corps Act (22 U.S.C. 2504(e)); or (k) the State Children’s 
Health Insurance Program (SCHIP). 5 

What is a preexisting medical condition? Under the Act, a preexisting 
medical condition is a physical or mental condition for which medical advice, 
diagnosis, care, or treatment was recommended or received within the 6-month 
period ending on the enrollment date. The enrollment date is the date of enrollment 
of the individual in the health plan or insurance, if earlier, the first day of the waiting 
period for such enrollment. 6 Pregnancy is not considered a preexisting medical 
condition. Also, a preexisting medical condition limit or exclusion may not be 
imposed on covered benefits for newborns who are covered under creditable 
coverage within 30 days of birth. Finally, a preexisting medical condition limit or 
exclusion may not be imposed on covered benefits for newly adopted children or 
children newly placed for adoption, if the child becomes covered under creditable 
coverage within 30 days of the adoption or placement. 

Final regulations 7 implementing the health coverage portability provisions of 
HIPAA addressed other types of benefit exclusions that are not designated as 
preexisting condition exclusions by the plan, but are considered to be so by the 
regulators. Examples of these specific benefit exclusions include provisions 
excluding coverage of pregnancy until 12 months after the individual is eligible for 
benefits, or provisions excluding treatment of injuries relating to accidents that 
occurred prior to enrollment. Plans are required to bring those exclusions into 
compliance with HIPAA portability provisions by July 1, 2005. 

The Act also prohibits the use of genetic information as a preexisting condition, 
unless there is a diagnosis of a preexisting medical condition related to the 
information. For example, evidence of a positive test for the gene that predisposes 
a woman to inheritable breast cancer cannot be treated as a preexisting condition, 
unless a diagnosis of breast cancer is made within the 6-month period described 
above. 

What is a preexisting medical condition limitation period? During 
this period, a plan may exclude or restrict coverage of a participant’ s or beneficiary ’ s 
preexisting medical condition. Under the Act, a group health plan is prohibited from 
imposing more than a 12-month preexisting condition limitation period (18 months 
for late enrollees) on an HIPAA-eligible participant or beneficiary. As described 
below, that period is reduced by the amount of the individual’s creditable coverage. 
In the individual market, HIPAA-eligible individuals also have portability protection, 



5 Having creditable coverage does not necessarily make an individual eligible for the group- 
to-individual market protections. See below for a discussion of the limitations of these 
protections. 

6 See below for more information on limitation and waiting periods. 

7 U.S. Department of the Treasury, Department of Health and Human Services, and 
Department of Labor, “Final Regulations for Health Coverage Portability for Group Health 
Plans and Group Health Insurance Issuers Under HIPAA Titles I & IV,” 69 Federal Register 
78720 (Dec. 30, 2004). 
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although the circumstances under which those protections apply are complex as 
described in more detail below. 

Portability in the Group Market 

HIPAA requires group health plans (plans that are offered to an employment- 
based group — including both employers and employee organizations) that are 
covered by the Act to meet the following requirements related to portability: 

• When a person with prior creditable coverage first enrolls in a group health 
plan, the plan cannot impose a limitation period on a preexisting condition 
that is longer than 12 months (18 months for late enrollees as defined below). 
The length of the allowed preexisting condition limitation period is based on 
any creditable coverage that an individual may have. The plan cannot apply 
any preexisting condition waiting period on pregnancy, a covered newborn, 
or on any covered child under 18 who is adopted (even if the adoption is not 
finalized). However, the employer may still require individuals to work for 
a period of time before they are allowed to participate in the health plan. This 
is called a “waiting period” and should not be confused with a “preexisting 
condition limitation period.” 8 

• Employers who sponsor group health plans are required to provide enrollees 
with a certificate that states the amount of creditable coverage accumulated 
and whether or not the enrollee was subject to a waiting period under the 
employer’s plan. Individuals can use this certificate to demonstrate prior 
creditable coverage when moving to a new group or individual health 
insurance plan. The Act does not require an employer to continue offering 
coverage to enrollees who have left their jobs, except under COBRA 
continuation provisions as described below. 

How do people take full advantage of the portability provisions of 
the Act? To benefit from the Act, individuals should maintain coverage under a 
health insurance plan without experiencing significant lapses in coverage. Since the 
portability protection only applies to people with “continuous coverage”, which the 
statute defines as coverage with no lapses of 63 or more days, individuals should not 
allow their insurance coverage to lapse for 63 or more days. 

How long can a group health plan restrict coverage for a 
preexisting medical condition? Coverage of a preexisting medical condition 
may be limited or excluded for up to 12 months for those who enroll in a health plan 
when first eligible to enroll. In the case of late enrollment, the maximum permitted 
limitation is 18 months. 

For those moving from one group plan to another group plan, or from individual 
to group coverage, the new plan must reduce any preexisting condition limitation 
period by one month for every month that such individuals had creditable coverage 
under a previous plan, provided that they enroll when first eligible and had no break 



See below for more information on limitation and waiting periods. 
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in previous coverage of 63 or more continuous days. For example, individuals with 
6 months of prior creditable coverage could face a maximum preexisting condition 
limitation period of 6 months. Individuals with 11 months of prior creditable 
coverage could face a maximum limitation period of 1 month. Once a 12-month 
limitation period is met, no new limitation may ever be imposed as long as 
continuous coverage is maintained (that is, there is no break in coverage lasting 
longer than 62 days), even if there is a change in jobs or health plans. If there is a 
period of 63 consecutive days during which individuals have no creditable coverage, 
they may be subject to as much as a 12-month preexisting condition exclusion period 
(or an 18 month exclusion for late enrollees). 9 

Individuals establish eligibility for a waiver of preexisting condition limitations 
by presenting certifications that document prior creditable coverage. Health plans 
and health insurance issuers must supply written certifications of: the period of 
creditable coverage under the plan; coverage (if any) under COBRA continuation 
provisions; and any waiting or affiliation periods imposed. The certification must be 
provided: (1) when a participant is no longer covered under the plan or otherwise 
becomes covered under a COBRA continuation provision; (2) after termination of 
COBRA coverage, if applicable; and (3) upon a request which is made not later then 
24 months after coverage ends. The interim rules issued by the three agencies 
administering the Act provide guidance and model certification forms to streamline 
this process. 10 In general, the certification must be provided in writing. 

What is late enrollment? Late enrollment occurs when an individual enrolls 
in a group health plan other than during: (a) the first period in which the individual 
is eligible to enroll under the plan, or (b) a special enrollment period. As described 
above, a group health plan may require a late enrollee to wait 18 months before a 
preexisting condition is covered. 

What is a waiting period? How does it differ from a preexisting 
condition limitation period? A waiting period is a set amount of time an 
employee must wait before he or she is eligible to enroll in a health plan. For 
example, an employer may require an employee to work for 6 months before health 
insurance benefits become available. The Act does not limit this type of waiting 
period — employers and health insurance issuers are free to determine the length of 
a waiting period. However, the Act requires that any waiting period be applied 
uniformly without regard to the health status of potential plan participants or 
beneficiaries. Also, days in a waiting period are not taken into account when 
determining whether an individual has experienced a break in coverage of 63 or more 
days. 



This differs from a preexisting condition exclusion limitation period which 
allows plans to exclude coverage for certain preexisting health conditions for up to 
12 months (or 18 months), as described above. Any waiting period required before 
an employee or his or family member can become a plan participant or beneficiary 
must run concurrently with any preexisting condition limitation period. For 



9 See “What Is Late Enrollment?” below. 

10 69 Federal Register 16894 (Apr. 8, 1997). 
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example, if an employer required an employee without any creditable coverage to 
work for 5 months before he or she could enroll in the firm’s health plan, then the 
preexisting condition limitation period imposed on the coverage of that individual 
could not exceed 7 months from the date of actual enrollment in the plan. If that 
individual had 7 or more months of creditable coverage, then no preexisting 
condition limitation period could be imposed on the coverage under the new plan. 

Do plans and issuers have any discretion in the method of crediting 
prior coverage? Yes, when an individual changes plans, the new benefit package 
may cover some benefits that were not covered under his or her most recent prior 
plan, and the law allows the new plan or issuer some discretion in applying prior 
creditable coverage to those new benefits. Plans and issuers may choose between 
two alternatives when determining creditable coverage: 1) they can chose to include 
all periods of coverage from qualified sources and thus not look at any specific 
benefits; or 2) they can examine prior coverage on a benefit- specific basis, and are 
allowed to exclude from creditable coverage any categories or classes of benefits not 
covered under the most recent prior plan. The April 8, 1997 interim rule defines the 
categories of benefits that may be considered separately to be: (a) mental health; (b) 
substance abuse treatment; (c) prescription drugs; (d) dental care; or (e) vision care. 11 
Thus, for example, if a prior plan did not cover prescription drugs, and the new plan 
includes this benefit, the new plan may exclude coverage of prescription drugs for up 
to 12 months under this second method. If the second method is chosen, plans or 
issuers must disclose its use at the time of enrollment or sale of the plan, and apply 
it uniformly. 

Do these protections apply to an individual’s spouse and children ? 

Under a group health plan, an employer is not required to offer coverage to an 
individual’ s spouse or children. If the employer does offer family coverage, the same 
protections apply to a spouse and dependents. Coverage may not be denied because 
a family member is sick, and preexisting condition restrictions are limited as 
described above. 

Portability and Guaranteed Availability in the Individual 
Insurance Market 

HIPAA guarantees the availability of apian and prohibits pre-existing condition 
exclusions for certain eligible individuals who are moving from group health 
insurance to insurance in the individual market. States have the choice of either 
enforcing the HIPAA individual market guarantees, referred to as the “federal 
fallback”, or they may establish an “acceptable alternative state mechanism”. In 
states using the federal fallback approach, HIPAA requires all health insurance 
issuers operating in the individual health insurance market to offer coverage to all 
eligible individuals and prohibits them from placing any limitations on the coverage 
of any preexisting medical condition. 

Issuers can comply with the Act’s requirements in three ways: 



11 69 Federal Register 16932, 16945-46, 16961-62. 
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(1) they must offer eligible individuals access to coverage to every individual 
insurance policy they sell in the state; or 

(2) they must offer eligible individuals access to coverage to their two most 
popular insurance policies (based on premium volume); or 

(3) they must offer eligible individuals access to a lower-level and higher-level 
coverage. These two policies must include benefits that are substantially similar 
to other coverage offered by the issuer in the state, and must include risk 
adjustment, risk spreading, or financial subsidization. 

Issuers can refuse to cover individuals seeking portability from the group market 
if financial or provider capacity would be impaired. This means, for example, that 
if a network-based plan like an HMO can demonstrate that it is filled to capacity, 
then it would not have to accept eligible individuals. It would have to apply this 
exception uniformly, without regard to the health status of applicants. 

Who is eligible for group-to-individual market portability and 
guaranteed availability under the Act? An eligible individual must have: 

• creditable health insurance coverage for 18 months or longer; 

• most recent coverage under a traditional employer group plan, governmental 
plan, or church plan; 

• exhausted any COBRA (or other continuation) coverage; 12 

• no eligibility for coverage under any employment-based plan, Medicare or 
Medicaid; and 

• no breaks in coverage of 63 or more days. 13 

Individuals purchasing insurance on their own who do not meet these eligibility 
criteria, are not protected by HIPAA’s portability and guaranteed availability 
provisions. These individuals may be protected under state laws. 

What are the limitations of the group-to-individual portability and 
guaranteed availability protections? The group-to-individual portability and 
guaranteed availability protections apply only to individuals whose most recent 
coverage was provided through traditional employer-based group arrangements, 



12 Individuals may have continuation coverage that is not COBRA coverage under FEHBP 
or under state continuation of coverage laws. 

13 An eligible individual must have 18 months of creditable health insurance coverage, at 
least the last day of which was under a group health plan. A child is deemed to be an 
eligible individual if the child was covered under any creditable coverage within 30 days of 
birth, adoption, or placement for adoption, and the child has not had a break in coverage of 
63 or more days. (Issuers are not required, however, to offer family coverage.) 69 Federal 
Register 16996 (Apr. 8, 1997).. 
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governmental plans or church- sponsored plans. Group plans are defined as those 
meeting the ERISA definition, which is limited to those sponsored through a 
traditional employer-employee relationship or an employment-based association. 
Governmental plans are also defined in ERISA. They are plans that are established 
or maintained for its employees by the Government of the United States, the 
government of a state or a political subdivision of a state. This limitation means that 
people whose most recent coverage was sponsored by the military (CHAMPUS and 
TRICARE), many college- sponsored student plans, the Peace Corps, the Veterans 
Administration, the Indian Health Service, Medicare, Medicaid and SCHIP are not 
eligible for the federal group-to-individual portability and guaranteed availability 
protections. (State laws, however, may offer these individuals such protections.) 

What are the requirements for an acceptable alternative state 
mechanism? An acceptable alternative state mechanism for coverage of eligible 
individuals must: 

• provide a choice of health insurance coverage to all eligible individuals; 

• not impose any preexisting condition restrictions; and 

• include at least one policy form of coverage that is comparable to either 
comprehensive health insurance coverage offered in the individual market in 
the state, or a standard option of coverage available under the group or 
individual health insurance laws in the state. 

In addition to these requirements, a state may implement one of the following 
mechanisms: 

• certain National Association of Insurance Commissioners (NAIC) Model 
Acts 14 ; 

• a qualified high-risk pool 15 that meets certain specified requirements; or 

• other risk spreading or risk adjustment approach, or financial subsidies for 
participating insurers or eligible individuals; or 

• any other mechanism under which eligible individuals are provided a choice 
of all individual health insurance coverage otherwise available. 



14 The NAIC Model Acts include the Small Employer and Individual Health Insurance 
Availability Model Act, as it applies to individual health insurance coverage, and as revised 
in state regulations to meet all the necessary requirements and the Individual Health 
Insurance Portability Model Act, as adopted on June 3, 1996 and revised in state regulation 
to meet all necessary requirements. 

15 A high-risk pool is generally the insurer of last resort, typically for sicker and/or older 
individuals who: (1) are denied coverage in the private market; (2) are offered only 
restricted coverage; or (3) cannot find less expensive coverage. 




http://wikileaks.org/wiki/CRS-RL31634 



CRS-10 



Examples of potential alternative state mechanisms include health insurance 
coverage pools or programs, mandatory group conversion policies, guaranteed issue 
of one or more plans of individual health insurance coverage, open enrollment by one 
or more health insurance issuers, or a combination of such mechanisms. 

How have states implemented this provision? Table 1 provides 
information on how each state has implemented the Act’s group-to-individual 
portability provisions. As of December 2003, the District of Columbia and 10 states 
(Arizona, Delaware, Hawaii, Maryland, Missouri, Nevada, North Carolina, Rhode 
Island, Tennessee, and West Virginia) utilize the federal fallback mechanism. 
Missouri is also the only state that does not enforce these standards itself, and as a 
result CMS is responsible for enforcement in Missouri. As shown in Table 1 , many 
states have elected to provide group-to-individual portability through high-risk pools, 
while others utilize a combination of high-risk pools, existing state insurance reform 
laws, or other mechanisms. To obtain more information on a state’ s health insurance 
regulation of the individual market, individuals may wish to contact that state’s 
department of insurance. 

Table 1. State Group-to-individual Insurance Portability 

Mechanisms 



State 


Group-to-individual Portability Provision 


Alabama 


Alternative mechanism — high-risk health insurance pool. 


Alaska 


Alternative mechanism — high-risk health insurance pool. 


Arizona 


Federal fall-back. 


Arkansas 


Alternative mechanism — high-risk health insurance pool. 


California 


Alternate mechanism — plans must offer two most popular products. 


Colorado 


Alternative mechanism — high-risk health insurance pool. 


Connecticut 


Alternative mechanism — high-risk health insurance pool. 


Delaware 


Federal fall-back. 


District of 
Columbia 


Federal fall-back. 


Florida 


Alternative mechanism — guaranteed issue to HIPAA-eligible persons. 
Health plans required to offer a choice of conversion plans, one of 
which must be the state approved “standard policy” currently offered 
in the small group market. 


Georgia 


Alternative mechanism — assigned risk pool. HIPAA-eligible persons 
may apply for coverage to the Insurance Commissioner who then 
“assigns” eligible individuals to health plans based on a health plan’s 
pro rata volume of individual health insurance business done in the 
state. 


Hawaii 


Federal fall-back. 
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State 


Group-to-Individual Portability Provision 


Idaho 


Alternative mechanism — existing state insurance reform laws, 
including guaranteed issue of three products (basic, standard, and 
catastrophic), guaranteed renewal, preexisting condition limitations of 
12/6, and also retains pregnancy as a preexisting condition ( not in 
compliance with HIPAA ), coverage gap is 63 days, rating bands to limit 
rate variations to a range of 1 .7 to 1 for experience, health status and 
duration and allows demographic adjustments for age and gender. 


Illinois 


Alternative mechanism — high-risk health insurance pool. 


Indiana 


Alternative mechanism — high-risk health insurance pool. 


Iowa 


Alternative mechanism — high-risk health insurance pool. 


Kansas 


Alternative mechanism - high-risk health insurance pool. 


Kentucky 


Alternative mechanism — high-risk health insurance pool. 


Louisiana 


Alternative mechanism — high-risk health insurance pool. 


Maine 


Alternative mechanism — existing state insurance reform laws, 
including guaranteed issue of all products, guaranteed renewal, no 
preexisting condition waiting period applied to HIPAA-eligibles and 
12/6 for non-HIPAA eligibles, coverage gap of 63 days, community 
rating with adjustments limited to a range of 1.5 to 1 for age, smoking 
status, industry, and geography. 


Maryland 


Federal fall-back. 


Massachusetts 


Alternate mechanism — existing state insurance reform laws, including 
guaranteed issue of three products, guaranteed renewal, preexisting 
condition limitations of 6/6 and coverage gap of 63 days, modified 
community rating with adjustments for age, geography and benefit level 
limited to a range of 2 to 1 . 


Michigan 


Alternate mechanism — Blue Cross Blue Shield plan will enroll 
HIPAA eligibles. 


Minnesota 


Alternative mechanism — high-risk health insurance pool. 


Mississippi 


Alternative mechanism — high-risk health insurance pool. 


Missouri 


Federal fall-back with HHS enforcement. 


Montana 


Alternative mechanism — high-risk health insurance pool. 


Nebraska 


Alternative mechanism — high-risk health insurance pool. 


Nevada 


Federal fall-back. 


New 

Hampshire 


Alternative mechanism — high-risk health insurance pool. 
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State 


Group-to-Individual Portability Provision 


New Jersey 


Alternative mechanism — existing state insurance law, including 
guaranteed issue of five standardized products, guaranteed renewal, no 
preexisting condition waiting period applied to HIPAA eligibles (for all 
others preexisting condition limitations of 12/6), coverage gap of 30 
days, pure community rating. 


New Mexico 


Alternative mechanism — HIPAA-eligibles can choose to obtain 
coverage through either the high-risk health insurance pool or the 
purchasing alliance. 


New York 


Alternative mechanism — existing state insurance reform laws, 
including guaranteed issue of all products, guaranteed renewal, no 
preexisting condition waiting period applied to HIPAA eligibles (for all 
others preexisting condition limitations of 12/6), coverage gap of 63 
days, community rating with adjustments permitted for family 
composition and geographic regions. 


North 

Carolina 


Federal fall-back. 


North Dakota 


Alternative mechanism — high-risk health insurance pool. 


Ohio 


Alternative mechanism — separate open enrollment period for HIPAA 
eligibles until health plans meet their enrollment caps. 


Oklahoma 


Alternative mechanism — high-risk health insurance pool. 


Oregon 


Alternative mechanism — high-risk health insurance pool. 


Pennsylvania 


Alternative mechanism — Blue Cross and Blue Shield Plans serve as 
the guaranteed issue carrier. 


Rhode Island 


Federal fall-back. 


South 

Carolina 


Alternative mechanism — high-risk health insurance pool. 


South Dakota 


Alternative mechanism — existing state insurance reform laws, 
including guaranteed issue to HIPAA-eligibles until these enrollees 
represent 2% of annual earned premium, guaranteed renewal, 
preexisting condition limitations to 12/6, and also retains pregnancy as 
a preexisting condition ( not in compliance with HIPAA), coverage gap 
is 63 days, rating reform limits adjustments for health status and claims 
experience to 2.2 to 1. 


Tennessee 


Federal fall-back. 


Texas 


Alternative mechanism — high-risk health insurance pool. 
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State 


Group-to-Individual Portability Provision 


Utah 


Alternative mechanism — combines high-risk health insurance pool 
and existing insurance market guaranteed issue requirement. 
Individuals who are denied coverage by a plan and then are judged by 
objective guidelines to be “too healthy” must be covered by the health 
plan that had previously denied their coverage. Individuals who are not 
deemed “too healthy” would be eligible for coverage in the high-risk 
pool. 


Vermont 


Alternative mechanism — existing state insurance reform laws, 
including guaranteed issue of all products, guaranteed renewal, no 
preexisting condition waiting period applied to HIPAA eligibles (for all 
others preexisting condition limitations of 12/12), coverage gap of 63 
days, community rating with health plans required to limit rating 
adjustments to a range of 1.5 to 1 for one or more factors approved by 
the Commissioner. 


Virginia 


Alternative mechanism — guaranteed issue of all currently offered non- 
group products to HIPAA eligibles. 


Washington 


Alternative mechanism — high-risk health insurance pool. 


West Virginia 


Federal fall-back. 


Wisconsin 


Alternative mechanism — high-risk health insurance pool. 


Wyoming 


Alternative mechanism — high-risk health insurance pool. 



Source: Blue Cross and Blue Shield Association, State Legislative Health Care and Insurance Issues. 
2003 Survey of Plans. Washington, December 2003. 

Note: (1) For preexisting condition limitations there may be two numbers, such as 12/6. The first 
number denotes the exclusion period and the second number denotes the allowable look-back period. 
The federal maximum under HIPAA is 12/6, although states may impose shorter limits. (2) 
Additionally, for coverage gaps, HIPAA requires that all periods of creditable coverage be aggregated 
or combined, provided that the lapse between periods of coverage is less than 63 days. Individual 
states may require health plans to give credit for prior coverage even if the lapse was longer than 63 
days. (3) Rating bands are laws that restrict a plan’s use of experience, health status or duration of 
coverage in setting premiums rates for individuals. For example, a state may set the band of 2 to 1 for 
health status. 

Special Enrollment Periods in the Group Market 

As an adjunct to its portability requirement, the Act provides for two different 
special enrollment periods to ensure that people losing group health insurance 
coverage can more easily obtain other group coverage when it is available. The two 
special enrollment periods are: 



(I) Individual Losing Other Coverage. A group health plan or an issuer offering 
coverage in connection with a group health plan must allow an employee who is 
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eligible, but not enrolled, to become covered under the plan if the following 
conditions are met: 16 

• The employee or dependent was covered under a group health plan or had 
health insurance coverage at the time coverage was previously offered to the 
employee or dependent. For example, the employee may have been covered 
by a spouse’ s employer and declined coverage under his own employer’ s plan. 

• The employee stated in writing at the time of declining enrollment that the 
reason for declining was that he or she was covered under another health 
insurance plan. This condition applies only if the plan sponsor or issuer 
requires such a written statement. 

• The employee’s or dependent’s previous coverage was under a COBRA 
continuation provision that had become exhausted or was under some other 
coverage that had been terminated as a result of a loss of eligibility for the 
coverage (for reasons such as: legal separation, divorce, death, termination of 
employment, or reduction in the number of hours of employment), or because 
the employer contribution towards such coverage was terminated. 

To take advantage of a special enrollment period, the employee would have to 
request enrollment no later than 30 days after the date in which his or her prior 
coverage was exhausted or terminated. 

(2) Dependent Beneficiaries. This special enrollment period applies to individuals 
who become dependents through marriage, birth, adoption, or placement of adoption. 
Generally, this provision applies if a group health plan makes dependent coverage 
available, and the new dependent’ s spouse or parent is either a participant or eligible 
(including meeting any waiting periods) to be a participant under the plan. The 
newly dependent individual must be allowed to enroll as a beneficiary under the plan; 
however, enrollment must be sought within 30 days of the qualifying event (e.g., the 
marriage). Employees or spouses who are eligible, but not previously enrolled in the 
plan, may also enroll during this special enrollment. Coverage is effective on the 
date of the birth, adoption, or placement for adoption. In the case of marriage, 
coverage is effective no later than the first day of the month beginning after the date 
the request for enrollment is received. 

Non-Discrimination in the Group Market 

Can a group health plan refuse to enroll individuals with a history 
of illness or disability or high medical expenses? Can it drop someone 
from coverage who becomes sick or starts using a lot of medical care? 

No, the Act prohibits a group health plan and an issuer offering group health 
coverage from establishing rules for eligibility for any individual to enroll under the 



16 The employee’s dependent would also be allowed to enroll, if family coverage is provided 
under the terms of the plan. 
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plan based on health status-related factors. 17 These factors include health status, 
medical condition (including both physical and mental illnesses), claims experience, 
receipt of health care, medical history, genetic information, evidence of insurability 
(including conditions arising out of domestic violence) and disability. Group health 
plans are also prohibited from failing to re-enroll a participant or beneficiary on the 
basis of health status-related factors. HIPAA also prohibits plans from charging 
differential premiums for enrollees within a group plan based on these health status- 
related factors. 

Can an employer condition coverage under its health plan on 
passing a physical examination? No, the Act prohibits employer plans and 
issuers of group health coverage from establishing rules of eligibility to enroll under 
the terms of the plan that discriminate based on one or more health-status related 
factors. 

Can a group plan refuse to enroll individuals who engage in high- 
risk recreational activities? No, these individuals cannot be denied enrollment 
in a group health plan, based on HIPAA’ s non-discrimination provision. Group plans 
or issuers offering group health coverage cannot use information about an 
individual’s health status to either deny coverage or charge differential premiums. 
On January 8, 2001, the Department of Labor issued a preliminary final ruling with 
comment period, defining the nondiscrimination provisions of HIPAA. In this ruling, 
“health status” is defined very broadly to include “evidence of insurability” which in 
turn includes a provision that prohibits excluding coverage for individuals who 
participate in high-risk activities. 18 Thus, this broad interpretation extends the 
nondiscrimination protections to individuals who engage in high-risk recreational 
activities. 

Can a group plan exclude coverage of treatments for injuries 
obtained while engaging in high-risk recreational activities? HlPAA’s 
protection extend to enrollment policies and premiums. The protection does not 
address the benefits that are covered by these plans. Therefore, there is no federal 
requirement to cover treatments for injuries associated with high-risk activities, even 
if these treatments are otherwise covered under the plan. For example, a plan may 
exclude coverage for a broken leg if it occurs as a result of a high- risk activity. 



17 In the individual market there are no federal rules explicitly limiting denials based on 
health status. On the other hand, portability and guaranteed issue protections may apply (see 
above section on Portability and Guaranteed Availability in the Individual Insurance 
Market). 

18 This ruling stems from language in the conference report on HIPAA: 

The inclusion of evidence of insurability in the definition of health status is 
intended to ensure, among other things, that individuals are not excluded from 
health care coverage due to their participation in activities such as motorcycling, 
snowmobiling, all-terrain vehicle riding, horseback riding, skiing, and other 
similar activities. 



H.Rept. 104-736, 104 th Cong., 2d Sess. 186 (1996). 
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Do these non-discrimination protections apply to an individual’s 
spouse and children? Under a group health plan, an employer is not required 
to offer coverage to an individual’s spouse or children. If the employer does offer 
family coverage, the same non-discrimination protections apply to a spouse and any 
other dependents as defined under the terms of the plan. Coverage may not be denied 
because a family member is sick, and preexisting condition restrictions are limited 
as described above. 

Does the Act restrict the premium amounts that an employer can 
charge for health insurance? No, the Act does not restrict premium amounts 
that an employer or insurer can charge. It also expressly permits an employer or 
group health insurer to offer premium discounts or rebates, or modify otherwise 
applicable copayments or deductibles, for participation in health promotion and 
disease prevention programs. However, the Act does prohibit a health plan from 
charging an individual a higher premium than the premium charged for another 
similarly situated individual enrolled in the plan on the basis of any health-related 
factor, such as a preexisting medical condition. 

Guaranteed Issue and Guaranteed Renewability 

The Act requires insurers, HMOs, and other issuers of health insurance selling 
in the small group market to accept any small employer that applies for coverage, 
regardless of the health status or claims history of the employer’s group. 19 This 
requirement is often referred to as “guaranteed issue.” The Act defines a small 
employer as one with two to 50 employees. (If, on the first day of the plan year, the 
plan has fewer than two participants who are current employees, it is not considered 
a small group and would not be covered by this “guaranteed issue” requirement.) 
Under guaranteed issue, the issuer must accept for enrollment under the policy, not 
just the employer’s group, as a whole, but also every eligible individual in the 
employers’ group who is eligible for and applies for timely enrollment. 20 Exceptions 
to guaranteed issue are provided in the Act for network plans that might otherwise 
exceed capacity limits or in the event that the employer’s employees do not live, 
work, or reside in the network plan’s area. 

Employer groups with more than 50 employees are not protected by this 
requirement unless otherwise required under state law. In the past, health insurance 
issuers usually did not examine the health status or medical history of larger 
employer groups when deciding whether to accept such groups for coverage. The 
Act requires the Secretary of Health and Human Services (HHS) and the General 
Accounting Office (renamed the Government Accountability Office in July 2004) to 
report every three years, beginning in December 2002, on access to health insurance 
in the large group market. 



19 This is consistent with most state health insurance reforms which primarily apply to the 
small group market (typically defined as 2 to 25, 2 to 35 or 2 to 50 employees). However, 
some state laws provide for guaranteed issue of groups with as few as one employee. 

20 The interim rules interpret the guaranteed issue requirement to apply to all products 
actively marketed by an issuer in the small group market. 69 Federal Register 1697 1 ( Apr. 
8, 1997). 
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Can health insurance issuers drop or cancel coverage for groups 
because of high medical costs? No, the Act requires all health insurance 
issuers to continue coverage for any group, regardless of health status or use of 
services, if the group requests renewal. This requirement is known as guaranteed 
renewability. An issuer may drop coverage in cases of non-payment of premiums, 
fraud, or similar reasons not related to health status, such as violation of participation 
or contribution rules. 21 But, there are no limits on amounts insurers may charge. 

Federally Required Benefits 

As originally passed, HIPAA did not require an employer or issuer of group 
health insurance to offer specific benefits. Twice since its passage Congress added 
to HIPAA’ s protections by mandating specific benefits, but in each case only for 
plans that cover certain services. As part of the FY 1997 appropriations bill for the 
Departments of Veterans Affairs and Housing and Urban Development (VA-HUD), 
Congress included provisions that ( 1 ) require plans that cover mental health services 
to provide limited mental health “parity”, and (2) prohibit plans that cover newborn 
delivery from limiting hospital stays for newborn delivery to less than two days. 22 
The FY1999 Omnibus Appropriations Act incorporated the Women’s Health and 
Cancer Rights Act, which requires plans that cover mastectomy as a treatment for 
breast cancer to also cover reconstructive surgery. 23 

Mental Health Parity. Private health insurers often provide less coverage for 
the treatment of mental illnesses than they do for the treatment of other illnesses. For 
example, health plans may limit treatment of mental illnesses by covering fewer 
hospital days and outpatient office visits, and increase cost sharing for mental health 
care by raising deductibles and copayments. Twenty-two states have passed full- 
parity laws that require health plans to impose the same treatment limitations and 
financial requirements on their mental health coverage as they do on their medical 
and surgical coverage. Several other states have enacted legislation that requires 
health plans to provide certain specified mental health benefits (but not full parity). 
However, these state laws have a limited impact because they do not cover self- 
insured plans. ERISA exempts self-insured plans from state regulation. Nationwide, 
about 52% of covered workers are in a self-insured plan, according to the 2003 
KFF/HRET survey of employer health benefits. 

In 1996, Congress passed the Mental Health Parity Act (MHPA), which 
amended ERISA and the Public Health Service Act to establish new federal standards 



21 An example of a participation rule is a requirement set by the issuer that 80% of all full 
time employees participate in the employer’s group health plan. An example of a 
contribution requirement is that all participants in the health plan must pay 20% of the plan 
premium. These requirements are used to protect the issuer from a selection bias (also 
known as “adverse selection”) in which only sick members of an employer’s group sign up 
for insurance coverage. 

22 FY1997 appropriations bill for the Departments of Veterans Affairs and Housing and 
Urban Development (P.L. 104-204, Title VII). 

23 In addition to HIPAA’ s limited federal protections, most states have their own mandates 
for insurers operating in their states. 
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for mental health coverage offered by employer-sponsored plans. 24 Identical 
provisions were later added to the Internal Revenue Code. 25 The MHPA is limited 
in scope and does not compel insurers to provide full-parity coverage. For group 
plans that choose to offer mental health benefits, the MHPA requires parity only for 
annual and lifetime dollar limits on coverage. Plans may still impose more restrictive 
treatment limitations and cost sharing requirements on their mental health coverage. 
The MHPA includes several other limitations. Employers with 50 or fewer 
employees are exempt from the law. In addition, employers that experience an 
increase in claims costs of at least 1% as a result of MHPA compliance can apply for 
an exemption. The MHPA currently is authorized through December 31, 2005. 

The 107 th Congress tried unsuccessfully to enact legislation (S. 543) that would 
have amended and expanded the MHPA by requiring plans that choose to offer 
mental health benefits to provide full-parity coverage. Full-parity legislation is 
strongly supported by advocates of the mentally ill and enjoys broad bipartisan 
support among lawmakers. Employers and health insurance organizations oppose 
such legislation because of concerns that it will drive up health care costs. For more 
information, see CRS Report RL31657, Mental Health Parity. 

Newborns’ and Mothers’ Health Protection Act. The Newborns’ and 
Mothers’ Health Protection Act was also passed as part of P.L. 104-204. This Act 
prohibits group health plans and issuers offering group coverage from restricting the 
hospital length of stay for childbirth for either the mother or newborn child to less 
than 48 hours for normal deliveries and to less than 96 hours for caesarian deliveries. 

Women’s Health and Cancer Rights Act of 1 998. Enacted in 1998, Title 
IX of the FY1999 Omnibus Appropriations Act 26 requires group plans and health 
insurance issuers that provide coverage for mastectomies also to cover prosthetic 
devices and reconstructive surgery. The provision included a requirement that 
beneficiaries be notified of available coverage for prostheses and treatment of 
physical complications of reconstructive procedures. 

Can an employer exclude coverage for specific types of illnesses, 
such as cancer, or acquired immune deficiency syndrome (AIDS) or 
treatment of injuries associated with high-risk activities? Federal law 
does not prohibit employers from excluding treatment of specific illnesses or 
conditions from their health benefit plans. On the other hand, a number of factors 
limit certain employers’ ability to exclude specific illnesses from coverage. Most 
states have enacted legislation requiring that specific benefits or coverage be included 
in insured products. Some employers, particularly small ones, purchasing insurance 
products have little or no discretion in choosing or excluding specific types of 
services or procedures. This is because many insurance companies and HMOs have 
a set menu of products that do not vary considerably from one employer group to 



24 P.L. 104-204, Title VII, codified at 29 U.S.C. 1185a and 42 U.S.C. 300gg-5. These 
provisions were part of the FY1997 VA-HUD appropriations bill. 

25 P.L. 105-34, Section 1531(a)(4), codified at 26 U.S.C. 9812. 

26 P.L. 105-277, Title IX: Women’s Health and Cancer Rights. 
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another. For self-funded plans, however, ERISA prevents state laws from applying 
and benefits are crafted by each individual employer plan. Thus only the few federal 
requirements enacted in HIPAA and its amendments (described above) place specific 
coverage requirements on these self-funded plans. 

General Questions About the Health Insurance Reforms 

Do the requirements of the Act apply to the plans of employers that 
provide for dental-only coverage or vision-only coverage? No, such 
specific benefit plans do not have to comply with the requirements of the Act if they 
meet certain conditions spelled out in the Act. To be exempt, for example, the 
dental-only policy would have to be provided under a separate policy, certificate, or 
contract of insurance or not otherwise be an integral part of the plan. 

Do the requirements of the Act apply to association-sponsored 
group health plans? Yes, association plans must comply with the various 
requirements of the Act relating to group health coverage. For example, the sponsor 
of an association plan cannot drop a group from coverage because of the use of 
medical services by the group’s members. Moreover, the association plan must 
comply with the restrictions on the use of preexisting medical condition limitation 
periods, provide for creditable coverage, and renew coverage except in limited cases. 
However, nothing under the Act requires that an association plan accept for coverage 
individuals who are not members of the association. 

Can states impose requirements on insurers selling to group health 
plans that are different from those in the Act? Yes, states may impose their 
own requirements. But HIPAA ensures that state laws do not prevent the application 
of its consumer protections. For example, state laws regulating rating continue to 
apply because the Act generally does not address rating practices. On the other hand, 
the Act’s provisions relating to portability, such as restrictions on the use of 
preexisting medical condition limitation periods override state laws. Exceptions 
include specific types of state laws that provide for greater portability, such as state 
laws that: 

• define a preexisting medical condition to be one that existed for less than 6 
months prior to becoming covered (instead of the 6 months required under the 
Act); 

• provide for preexisting medical condition limitation periods shorter than 12 
(and 18) months in the Act; and 

• allow for breaks in continuous coverage longer than the 62-day period 
specified under the Act. 27 

Thus, for example, a state may prohibit issuers selling to group health plans from 
imposing more than a 6-month preexisting medical condition limitation period on 



27 Other possible types of state laws providing for greater consumer protections are also 
specified in the Act. 
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enrollees, instead of the 12-month limit in the Act. However, state laws that allowed 
such limitation periods in excess of 12 months would be overridden by the 
requirement of the Act. 

Do the insurance reforms apply to Federal Employees' Health 
Benefits Plans (FEHBP)? While there are no specific references in HIPAA or 
the subsequent benefits mandates that apply the requirements specifically to FEHBP, 
the plans provided by the FEHBP program are presumed to fall under the HIPAA 
definition of “group health plan.” As a result, the federal Office of Personnel 
Management, which administers the FEHBP program, complies with the HIPAA 
requirements. 

Does the Act regulate the premium amount that an issuer can 
charge an eligible individual? No, the Act does not place any restrictions on the 
premium amount that issuers can charge. However, some states limit insurance 
premiums in the individual market and more may decide to do so in the future. Such 
limits would then apply because the Act does not preempt or override either current 
or future state laws regulating the cost of insurance. 

Implementation and Enforcement 

The Secretaries of HHS, Labor, and Treasury are required to jointly enforce the 
provisions of the Act. The Secretary of Labor enforces the requirements on employer 
plans under Title I of ERISA. The Secretary of Labor is also generally given 
authority to promulgate regulations necessary to carry out the provisions of the Act 
relating to group health plans and health insurance issuers in connection with any 
group health plan. The Secretary of Treasury enforces requirements on all group 
health plans under the Internal Revenue Code. Requirements on health insurance 
issuers (such as insurance carriers and HMOs) are enforced by the Secretary of HHS 
to the extent that such requirements are not enforced by the states. The Secretaries 
are required to coordinate their activities to avoid duplication of effort. 

States have the primary responsibility for enforcing HIPAA’ s access, portability 
and renewability standards applying to insurers in both the group and individual 
markets. If they do not pass laws that substantially enforce these standards, however, 
DHHS must do the enforcing itself. As of 2001, only Missouri had not enacted 
enabling legislation. 

How are the insurance requirements of the Act enforced? 

Noncomplying group health plans covered under ERISA may be subject to civil 
money penalties, and both plans and issuers can be sued by participants and 
beneficiaries to recover any benefits due under the plan. The Secretary of Labor has 
the investigative authority to determine compliance with the law’ s requirements. For 
group health plans, generally the IRS can fine a noncomplying employer $100 per 
day per violation. 

Requirements on issuers will be enforced by the states. For Missouri, the 
Secretary of HHS enforces the provisions. The Secretary may impose a fine of $ 100 
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for each day the entity (the issuer or a nonfederal governmental plan) 28 is out of 
compliance. The Act gives the Secretary of HHS the authority to promulgate 
regulations needed to carry out the provisions of the Act relating to requirements on 
issuers of coverage. 

What regulations have been promulgated to define HIPAA? The 

following table lists the regulations regarding HIPAA’ s insurance provisions. For 
regulations on HIPAA ’s administrative simplification and privacy provisions see 
CRS Report RL30620, Health information standards, privacy and security: 
HIPAA ’s administrative simplification regulations , by Stephen Redhead. 



28 “A nonfederal governmental plan” is a plan sponsored by a state or local governmental 
entity. 
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Table 2. Federal Insurance Regulations Promulgated under HIPAA 



Date of Issue 


Title 


Purpose 


Status 


Citation 


April 8, 1997 


Health Insurance Portability for 
Group Health Plans; Interim 
Rules and Proposed Rule 

CO 

Oh 

CG 

Pi 

o 

33 

'bO 

o 

tn 


Interim rules governing access, portability 
and renewability requirements for group 
health plans and issuers of health insurance 
coverage offered in connection with a group 
health plan. 


Comment period 
ended July 7, 
1997 


Internal Revenue 
Service (IRS): 26 
CFR Part 54 

Pension Welfare 
Benefits 
Administration 
(PWBA): 29 CFR 
Part 2590 

Health Care 
Financing 
Administration 
(HCFA): 45 CFR 
Subtitle A, Parts 144 
and 146, 45 CFR 
Part 148 


April 8, 1997 


TO 

0) 

^Individual Market Health 
^Insurance Reform; Interim final 
Brule with comment period 


Portability from group to individual 
coverage; federal rules for access in the 
individual market; state alternative 
mechanisms to federal rules 


Comment period 
ended July 7, 
1997 


Health Care 
Financing 
Administration 
(HCFA): 45 CFR 
Part 148 


December 22, 
1997 


Mental Health Parity; Interim 
Rules 

HIPAA Mental Health Parity 
Act; Proposed Rule 


Interim rules governing parity between 
medical/surgical benefits and mental health 
benefits in group health plans and health 
insurance coverage offered by issuers in 
connection with a group health plan. 


Comment period 
ended on March 
23, 1998 


IRS: 26 CFR Part 54 

PWBA: 29 CFR Part 
2590 

HCFA: 45 CFR Part 
146 
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Date of Issue 


Title 


Purpose 


Status 


Citation 


December 29, 
1997 


Application of HIPAA Group 
Market Portability Rules to 
Health Flexible Spending 
Arrangements; Final Rule 
Application of HIPAA Group 
Market Rules to Individuals 
Who Were Denied Coverage 
Due to a Health Status-Related 
Factor; Final Rule 


Clarification of regulations with respect to 
treatment of benefits under flexible 
spending arrangements for the purposes of 
group market portability. 


Final (clarifies 
regulation issued 
April 8, 1997) 


IRS: 26 CFR Part 54 

PWBA: 29 CFR Part 
2590 

HCFA: 45 CFR 
Parts 144 and 146 


October 27, 
1998 


Group Health Plans and Health 
Insurance Issuers Under the 
Newborns’ and Mothers’ Health 
^Protection Act; Joint Interim 
SRule 

c h 
O 


Interim rules providing guidance to 
employers, group health plans, health 
insurance issuers, and participants and 
beneficiaries relating to new requirements 
for hospital lengths of stay in connection 
with childbirth. 


Comment period 
ended January 
25, 1999 


IRS: 26 CFR Part 54 

PWBA: 29 CFR Part 
2590 

HCFA: 45 CFR 
Parts 144, 146 and 
148 


August 20, 
1999 


^Federal Enforcement in Group 
Jand Individual Health Insurance 
^Markets; Interim Rule 

M 

a 


Details procedures for enforcing Title 
XXVII of the Public Health Service Act as 
added by HIPAA and as amended, in states 
that do not enforce the requirements of these 
acts. Delineates the process for taking 
enforcement actions against non-federal 
government plans, and, in those states in 
which HCFA (now named CMS) is directly 
enforcing the requirements, health insurance 
issuers that are not complying with the 
requirements. 


Comment period 
ended October 
19, 1999 


HCFA: 45 CFR 
Parts 144, 146, 148 
and 150 


October 25, 
1999 


Health Insurance Portability; 
Final Rule 


Solicitation of additional comments on 
interim rules published on April 8, 1997 
regarding a number of portability, access 
and renewability provisions as well as 
comments reflecting the experience that 
interested parties have had with the interim 
regulations. Also clarifies definition of late 
enrollee for purposes of applying pre- 
existing exclusion period. 


Comment period 
ended January 
25, 2000 


IRS: 26 CFR Part 54 

PWBA: 29 CFR Part 
2590 

HCFA: 45 CFR 
Subtitle A, Parts 144 
and 146 
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Date of Issue 


Title 


Purpose 


Status 


Citation 


January 8, 
2001 


Nondiscrimination in Health 
Coverage in the Group Market; 
Interim Final Rules and 
Proposed Rules 


Interim rules regarding provisions 
prohibiting discrimination based on a health 
factor for group health plans and issuers of 
health insurance coverage in connection 
with a group health plans. Proposed 
standards for defining bona fide wellness 
programs. 


Comment period 
ended April 9, 
2001 


IRS: 26 CFR Part 54 

PWBA: 29 CFR Part 
2590 

HCFA: 45 CFR Part 
146 


March 9, 2001 


Interim Final Rules for 
Nondiscrimination in Health 
Coverage in the Group Market 

<to 

Ph 


Delays for 60 days, the effective dates for 
the nondiscrimination rule published on 
January 8, 2001 


Final 


IRS: 26 CFR Part 54 

PWBA: 29 CFR Part 
2590 

HCFA: 45 CFR Part 
146 


December 30, 
2004 


sXjroup Health Plans and 
^Insurance Issuers; Access, 
^Portability, and Renewability 
^Requirements 

a3 

05 

^2 

‘S 

(X 


Final regulations governing portability 
requirements for group health plans and 
issuers of health insurance coverage offered 
in connection with a group health plan. 


Final 


IRS: 26 CFR Parts 
54 and 602 

EBSA: 29 CFR Part 
2590 

CMS: 45 CFR Parts 
144 & 146 


December 30, 
2004 


Health Coverage Portability; 
Tolling Certain Time Periods 
and Interaction with Family and 
Medical Leave Act 


Describes how the period that determines 
whether a significant break in coverage has 
occurred is to be tolled in cases in which a 
certificate of creditable coverage is not 
provided on or before the day coverage 
ceases and when a person is on leave under 
the Family Medical Leave Act 


Proposed with 
comment period 
to end on March 
30, 2005 


IRS: 26 CFR Part 54 

EBSA: 29 CFR Part 
2590 

CMS: 45 CFR Part 
146 


December 30, 
2004 


Request for Information on 
Benefit-Specific Waiting 
Periods Under HIPAA 
Titles I & IV 


Solicits comments about benefit-specific 
waiting periods allowing for the public to 
provide input into any criteria used to 
determine whether a benefit-specific waiting 
period utilized by a group health plan or 
issuer is a preexisting condition exclusion 
under HIPAA. 


The Departments 
requests 
comments be 
provided on or 
before March 30, 
2005. 


IRS: 26 CFR Part 54 

EBSA: 29 CFR Part 
2590 

CMS: 45 CFR Part 
146 
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Source: Congressional Research Service 

Notes: 

PWBA — Pension and Welfare Benefits Administration. Changed its name to the Employee Benefits Security Administration ( EBSA ). 
HCFA — Healthcare Financing Administration. Changed its name to Centers for Medicare and Medicaid Services (CMS). 

CFR — Code of Federal Regulations. 
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COBRA Continuation Coverage 

How does COBRA continuation coverage 29 interact with HIPAA? A 

person’s COBRA continuation coverage is considered creditable coverage in the 
case of an individual who moves from one group policy to another group policy or 
from a group policy to an individual policy. This allows an individual to move from 
COBRA to a new health plan without having to wait for coverage of any preexisting 
medical condition under the new plan, providing the individual does not have a lapse 
in coverage of 63 or more days. 

With respect to HIPAA’ s individual market protections, the situation is 
somewhat more complex. One of the requirements for eligibility for guaranteed 
availability and portability in the individual market is that an individual must first 
have elected and exhausted any available COBRA or other continuation coverage. 
Eligible individuals who do not have access to COBRA or other continuation 
coverage may move directly to the individual market. Additionally, in the individual 
market, it is important to note that the insurer accepting the eligible individual for 
coverage can charge whatever rate is allowed under state law. (The Act does not 
limit the premiums that insurers can charge.) 

Does HIPAA make any changes in COBRA continuation of coverage 
requirements? Yes, the Act makes several changes to the laws providing for 
COBRA continuation of coverage. It provides: 

• a clarification that a disabled qualified beneficiary and all other qualified 
family members of the beneficiary are also eligible for the additional 11 
months of COBRA; 

• that the qualifying event of disability applies in the case of a qualified 
beneficiary who is determined under the Social Security Act to be disabled 
during the first 60 days of COBRA coverage; 

• that a qualified beneficiary for COBRA coverage includes a child who is bom 
to, or placed for adoption with, the covered employee during the period of 
COBRA coverage; and 

• that COBRA can be terminated if a qualified beneficiary becomes covered 
under a group health plan which does not contain any exclusion or limitation 
affecting a participant or his or her beneficiaries because of the requirements 
of the Act. 

It should also be noted that under the Medical Savings Account (MSA) 
provisions of the Act (see below), individuals may withdraw funds from their MS As 
without penalty to pay their COBRA premiums. 



29 The Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA, P.L. 99-272) 
requires employers with 20 or more employees to offer continued group health insurance 
coverage to employees and their dependents after certain events. See CRS Report RL30626, 
Health Insurance Continuation Coverage under COBRA , by Heidi G. Yacker. 




http://wikileaks.org/wiki/CRS-RL31634 



CRS-27 



Part III. Other Provisions 

In addition to the insurance provisions discussed above, HIPAA includes other 
provisions affecting health care. This section briefly summarizes these provisions 
and refers readers to other CRS reports where available. 30 

Administrative Simplification 

In addition to provisions relating to private health insurance, HIPAA directed 
the Secretary of HHS to issue standards to support and promote the electronic 
transmission ofhealth care information between payers and providers. The standards 
specify the content and format of electronic health care claims and other common 
administrative and financial health care transactions (e.g., health plan enrollment, 
referrals). They are intended to streamline administrative operations within the 
health care system, which currently stores and transmits health information in 
numerous paper and electronic formats. In 2001 Congress enacted the 
Administrative Simplification Compliance Act (P.L. 107-105), which enabled payers 
and providers to seek a one-year extension on the October 16, 2002 deadline for 
compliance with the electronic transactions and codes standards. 

HIPAA’ s administrative simplification provisions also instructed the Secretary 
of HHS to develop security standards and safeguards, which health plans and 
providers must incorporate into their operations to protect health information from 
unauthorized access, use, and disclosure. Health care providers and most health 
plans must be in compliance with the security standards by April 21, 2005. In 
addition, HIPAA directed the Secretary to develop standards for unique health 
identifiers (i.e., ID numbers) for patients, employers, health plans, and providers. 
CMS has issued standards for both the employer and provider identifiers, but the 
health plan identifier remains under development. In each fiscal year since FY 1 999, 
Congress has prevented CMS from developing a standard for the unique patient 
identifier by inserting language in the agency’s annual appropriations bill. The 
language prohibits the use of funds for developing a unique patient identifier standard 
unless legislation is enacted specifically approving such a standard. 

The growing use of information technology in the management, administration, 
and delivery of health care has led to increasing public concern over the privacy of 
medical information. Patients are worried about who has access to their medical 
records without their express authorization. They fear that their personal health 
information will be used against them to deny insurance, employment, and housing, 
or to expose them to unwanted judgment and scrutiny. Lawmakers addressed these 
concerns by including in HIPAA’ s administrative simplification provisions a 
timetable for developing standards to protect the privacy of health information. 
HIPAA gave Congress until August 21,1 999, to enact comprehensive health privacy 
legislation, otherwise the Secretary was instructed to develop privacy standards. 



30 Not included in this summary are HIPAA provisions that were revenue raisers; these 
related to company-owned life insurance, individuals who lose U.S. citizenship or who were 
long-term residents and terminate U.S. residency, and interest allocation rules for financial 
institutions. 
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Congress was unable to meet its own deadline and so the Secretary proceeded to 
develop a health information privacy rule. The final rule was issued on December 
28, 2000, and modifications to the rule were published on August 14, 2002. For 
more information on the privacy rule, see CRS Report RS20500, Medical Records 
Privacy: Questions and Answers on the H1PAA Final Rule. Information on the 
status and implementation of all the HIPAA administrative simplification standards 
is at [http://aspe.os.dhhs.gov/admnsimp]. 

Medical Savings Accounts 

HIPAA authorized tax-advantaged medical savings accounts (MSAs) under a 
demonstration that began in 1997. MSAs (now formally called Archer MSAs) are 
personal savings accounts for unreimbursed medical expenses. They can be used to 
pay for health care not covered by insurance, including deductibles and copayments. 
The legislation provided that MSAs may be established by taxpayers who have 
qualifying high deductible insurance (and none other, with some exceptions) and who 
either are self-employed or are employees covered by the high deductible plan 
established by their small employer. 

Employer contributions to MSAs are not subject to either income or 
employment taxes, while contributions made by individuals — allowed only if the 
employer does not contribute — are allowed as an above-the-line deduction (not 
limited to itemizers). MSAs are held in trust by insurance companies, banks, and 
other financial institutions, and whatever earnings they have are exempt from taxes. 
Withdrawals are not taxed if they are for medical expenses unreimbursed by 
insurance or otherwise, while other distributions, being non-qualified, are included 
in gross income and subject with some exceptions to an additional 15% penalty. 

HIPAA set a deadline(originally December 31, 2000) for establishing new 
accounts and limited the total to various ceilings, eventually 750,000 accounts. In 
October, 2002, the IRS estimated that there would be 78,913 MSA returns filed for 
tax year 2001; it also determined that 20,592 taxpayers who did not make 
contributions in 2001 established accounts in the first six months of 2002. These 
numbers were far less than the 750,000 statutory ceiling. 31 Later amendments 
extended the deadline for new accounts to December 31, 2003. Although no new 
MSAs may be created, with some exceptions, current owners can maintain their 
accounts and, provided they have a qualifying high-deductible insurance, can 
continue to make contributions. However, most MSA owners can now have HSAs, 
and their MSA balances can be rolled over into the new accounts. 



31 IRS Announcement 2002-90. MSAs are not counted toward the statutory ceiling if the 
owners were previously uninsured; moreover, all accounts established by an individual are 
added together, and married individuals opening separate accounts are treated as having one 
account. The small number of MSA accounts opened can be attributed to a number of 
factors including product familiarity, consumer aversion to financial risk, and the reluctance 
of insurance agents to sell lower-priced policies ; however, statutory restrictions undoubtedly 
have played some role. 
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For more information about MS As and HSAs, see CRS Report RS21573, Tax- 
Advantaged Accounts for Health Care Expenses: Side-by-Side Comparison, by Bob 
Lyke and Chris L. Peterson, and CRS Report RL32467, Health Savings Accounts, by 
Bob Lyke, Chris L. Peterson, and Neela Ranade. For current legislative activity on 
tax-advantaged accounts, see CRS Issue Brief IB98037, Tax Benefits for Health 
Insurance and Expenses: Current Legislation, also by Bob Lyke. 



Health Insurance for Self-Employed Taxpayers 

HIPAA increased the portion of premiums that self-employed taxpayers may 
deduct from income for the purposes of determining federal taxes owed. Under prior 
law, the deduction was 30% of health insurance costs; HIPAA increased it to 40% 
in 1997; 45% in 1998 through 2002; 50% in 2003; 60% in 2004; 70% in 2005; and 
80% in 2006 and thereafter. Subsequent legislation (P.L. 105-34 and P.L. 105-277) 
accelerated and increased the percentages set by HIPAA. Beginning in 2003, 100% 
of health insurance costs can be deducted. As discussed below, HIPAA also allowed 
self-employed taxpayers to take account of long-term care insurance premiums in 
making this deduction. 

Self-Insured Plans 

HIPAA provided that payments for personal injury or sickness through an 
arrangement having the effect of accident or health insurance are excluded from gross 
income (that is, they are exempt from taxation), provided the arrangement has 
adequate risk shifting and is not merely a reimbursement arrangement. Thus with 
respect to taxes, payments from self-insured plans covering self-employed 
individuals are treated like payments from commercial insurance. 

Long-Term Care 

HIPAA established new rules regarding the tax treatment of long-term care 
insurance and expenses, effective January 1, 1997. Qualified long-term care 
insurance is treated as accident and health insurance, and benefits are treated as 
amounts received for personal injuries and sickness and reimbursement for medical 
expenses actually incurred. As a consequence, benefits are excluded from gross 
income (that is, exempt from taxation). The exclusion for benefits paid on a per diem 
or other periodic basis is limited to the greater of (1) $240 a day (in 2005) or (2) the 
cost of long-term care services. 32 

Employer contributions to the cost of qualified long-term care insurance 
premiums are excluded from the gross income of the employee. The exclusion does 



32 Treating long-term care insurance as accident and health insurance and excluding benefits 
from gross income also exempts the inside buildup of the insurance from taxation. Long- 
term care insurance usually has premiums that do not increase with age (aside from optional 
inflation adjustments for some policies); premiums for early years of a policy and the 
earnings on them (the inside buildup) help pay for costs later on. The tax treatment of 
nonqualified long-term care insurance remains uncertain. 
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not apply to insurance provided through employer-sponsored cafeteria plans or 
flexible spending accounts. 

Unreimbursed long-term care expenses are allowed as itemized deductions to 
the extent they and other unreimbursed medical expenses exceed 7.5% of adjusted 
gross income. Long-term care insurance premiums can be counted as these expenses 
subject to age-adjusted limits. In 2005, these limits range from $270 for persons age 
40 or less to $3,400 for persons over age 70. 

Self-employed individuals are allowed to include long-term care insurance 
premiums in determining their above-the-line deduction (not limited to itemizers) for 
health insurance expenses. Only amounts not exceeding the age-adjusted limits can 
be included. So limited, 100% of the cost of the insurance may be claimed as a 
deduction in 2005, as described above. 

Qualified long-term care insurance is defined as a contract that covers only long- 
term care services; does not pay or reimburse expenses covered under Medicare; is 
guaranteed renewable; does not provide for a cash surrender value or other money 
that can be paid, assigned, or pledged as collateral for a loan, or borrowed; applies 
all refunds of premiums and all policy holder dividends or similar amounts as a 
reduction in future premiums or to increase future benefits; and meets certain 
consumer protection standards. Policies issued before January 1, 1997, and meeting 
a state’s long-term care insurance requirements at the time the policy was issued are 
considered qualified insurance for purposes of favorable tax treatment. 

Qualified long-term care services are defined as necessary diagnostic, 
preventive, therapeutic, curing, treating, mitigating, and rehabilitative services, and 
maintenance or personal care services, which are required by a chronically ill 
individual, and are provided according to a plan of care prescribed by a licensed 
health care practitioner. However, amounts paid for services provided by the spouse 
of a chronically ill person or by a relative directly or through a partnership, 
corporation, or other entity will not be considered a medical expense eligible for 
favorable tax treatment, unless the service is provided by a licensed professional. 

Chronically ill persons are defined as those individuals: 

• unable to perform without substantial assistance from another individual at 
least two of the following activities of daily living (ADLs)for a period of at 
least 90 days due to a loss of functional capacity: bathing, dressing, 
transferring, toileting, eating, and continence; 33 

• having a level of disability similar to the level of disability specified for 
functional impairments (as determined by the Secretary of the Treasury in 
consultation with the Secretary of Health and Human Services); or 

• requiring substantial supervision to protect them from threats to health and 
safety due to severe cognitive impairment. 



33 A qualified long-term care insurance contract must take into account at least five of these 
six activities. 
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HIPAA required that a licensed health practitioner (physician, registered 
professional nurse, licensed social worker, or other individual prescribed by the 
Secretary of the Treasury) certify that a person meets these criteria within the 
preceding 12-month period. 

Accelerated Death Benefits 

HIPAA clarified that accelerated death benefits (that is, benefits paid before 
death) received under a life insurance contract on the life of an insured terminally or 
chronically ill individual are excluded from gross income. Also excluded are 
amounts received from a viatical settlement provider for the sale or assignment of a 
life insurance contract. 34 These exclusions do not apply to amounts paid to persons 
other than the insured if they have an insurable interest in the insured for business 
reasons. 

A terminally ill individual is one who has been certified by a physician as 
having an illness or physical condition which can reasonably be expected to result in 
death within 24 months of the date of certification. 

A chronically ill individual is defined the same way as for long-term care (see 
the previous section). In this case, the exclusion of accelerated death benefits is 
limited to the actual costs of long-term care incurred by the individual that are not 
compensated by insurance or otherwise. The exclusion for benefits paid on a per 
diem or other periodic basis is limited to the greater of (1) $240 a day (in 2005) or 
(2) the costs of long-term care services. 35 Contracts must not pay or reimburse 
expenses which are reimbursable under Medicare or would be but for the application 
of a deductible or coinsurance amount. In addition, contracts are subject to the 
consumer protection provisions specified in the tax code for long-term care 
insurance, except for analogous standards specifically applying to chronically ill 
individuals that are adopted by the National Association of Insurance Commissioners 
or the state in which the policyholder resides. 

State Insurance Pools 

HIPAA added two types of organizations to the list of those expressly exempt 
from the federal income tax: (1) state-sponsored membership organizations that 
provide insurance coverage or medical care to high-risk individuals, and (2) state- 
sponsored workmen’s compensation reinsurance organizations. Organizations in 
either classification must meet a number of requirements. 



34 Viatical settlement providers must be regularly engaged in the business of purchasing or 
accepting assignment of life insurance contracts on the lives of terminally or chronically ill 
individuals. They must be licensed in the state where the insured individual resides or meet 
certain National Association of Insurance Commissioners standards. 

35 Excess per diem or other regular payments are not taken into account if the individual has 
been certified as terminally ill. 
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Treatment of Certain Health Insurance Providers 

HIPAA allowed health insurance providers (other than health maintenance 
organizations) that are organized and governed under state laws specifically and 
exclusively applying to not-for-profit health insurance or service organizations to 
deduct 25% of claims and expenses incurred during the year, less adjusted surplus. 
Previously this tax treatment applied only to Blue Cross and Blue Shield 
organizations. 

IRA Distributions for Medical Expenses and Insurance 

HIPAA provided that the 10% early withdrawal penalty would no longer apply 
to individual retirement account (IRA) distributions used to pay medical expenses in 
excess of 7.5% of adjusted gross income. In addition, it provided that the penalty 
would not apply to IRA distributions used to pay health insurance premiums after 
separation from employment in the case of an individual who receives 12 consecutive 
weeks of unemployment compensation. 

Organ and Tissue Donation Information 

HIPAA required the Secretary of the Treasury to include organ and tissue donor 
information, to the extent practicable, in the mailing of individual income tax refunds 
from February 1, 1997 through June 30, 1997. authorized tax-advantaged medical 
savings accounts (MS As) under a demonstration that began in 1997. 36 



36 Under HIPAA, no new MSAs (with some exceptions) were to be established after 
December 31, 2000; the cut-off would have been earlier had thresholds on the number of 
accounts been exceeded. P.L. 106-554 extended the deadline for new accounts to December 
31,2002. 




